CVE-2026-102255

No known exploitation. EPSS puts it in the 39th percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile39th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-07Updated 2026-10-07Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

SonicWall SMA1000Affected: 12.4.3-03526 (platform-hotfix) and older versionsUpgrade to: not statedAffected: 12.5.0-02952 (platform-hotfix) and older versionsUpgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization runs a SonicWall SMA1000 appliance exposed to the internet for remote employee access.
If yes, immediately restrict or block internet access to the WorkPlace/Extraweb interface while a fix is pending.
Contact SonicWall support or your IT provider to confirm whether a patch has been released, since none is available as of this writing.
Review appliance logs for unusual OPTIONS requests or signs of internal service access, and report findings to your IT team.
Apply the vendor patch the moment it is released and monitor SonicWall advisories closely.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

5 publishers

Threat intelligence firms warn of early exploitation attempts against CVE-2026-102255, a critical pre-authentication SSRF flaw in SonicWall SMA1000 appliances, observed days after the patch was released.
as reported · Oct 12, 2026·Dark Reading summary
SonicWall and Splunk released patches addressing multiple critical and high-severity vulnerabilities, including pre-auth SSRF and RCE flaws in SonicWall SMA1000 and various issues in Splunk Enterprise.
as reported · Oct 8, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

In plain language

Written by AI from the record

A critical, actively exploited flaw in SonicWall's SMA1000 remote-access appliance lets attackers break in without any password, and there is no fix yet — if you use this device, treat it as an emergency.

Pre-authentication SSRF in the SMA1000 WorkPlace interface (CWE-441/CWE-918) allows an unauthenticated attacker to abuse an alternate access path to force the appliance into making requests against its internal CouchDB service, bypassing authentication controls entirely; exploitation is already observed in the wild with no vendor patch yet.

If you're affected

Full appliance compromise
Internal network exposure
Remote access system takeover
Unauthorized access to business systems
Operational disruption

What is it

Think of this remote-access appliance as the front door your employees use to log into company systems from outside the office. This flaw lets a stranger with no key at all trick that door into opening internal rooms for them, bypassing the lock entirely. Attackers are already testing this trick against real systems.

Who is affected

This matters to you if your business uses a SonicWall SMA1000 appliance to provide employees with secure remote access to internal systems. The vulnerability is reachable directly over the internet through the WorkPlace interface, with no login or user action required from anyone — if your appliance is internet-facing, it is exposed right now.

How urgent is it

Attackers are already exploiting this flaw — security researchers have detected real exploitation attempts in honeypot networks using crafted requests against the internal service, not just theoretical risk. With no authentication needed and no patch currently available, this is a critical, active threat that demands immediate action, not a wait-and-see response.

What to do — in detail

Confirm whether SMA1000 appliances in your environment expose the WorkPlace/Extraweb interface to the internet. There is no fixed version available yet per vendor patch data, so immediate mitigation should focus on restricting external access to the WorkPlace interface (via firewall rules, VPN-only access, or temporarily disabling the service) until SonicWall issues a patch. Monitor appliance and network logs for OPTIONS requests targeting internal paths, particularly any referencing CouchDB (127.0.0.1:5984) or '_rewrite' endpoints, and for use of default credentials like admin:admin against internal services. Subscribe to SonicWall security advisories for the forthcoming patch and apply it immediately upon release. This CVE is not yet listed in CISA KEV, but active exploitation reported by Previdian's honeypot network since 2026-10-09 warrants treating it with KEV-level urgency regardless.

Technical context

CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects maximum severity: network-exploitable, no privileges or user interaction required, scope change, and complete loss of confidentiality, integrity, and availability. The weakness is classified as CWE-441 (Unintended Proxy/Intermediary) combined with CWE-918 (Server-Side Request Forgery), exploited via an alternate access path to the WorkPlace interface that bypasses intended authentication checks and allows requests to reach internal services (observed: CouchDB at 127.0.0.1:5984 via _rewrite endpoint with default admin:admin Basic Auth). Exploitation is confirmed in the wild via honeypot telemetry (Previdian, first reported 2026-10-09); no public exploit code is currently on record and the CVE is not yet in CISA KEV, but real-world attack activity should be treated as overriding any EPSS-based likelihood estimate. No patch is currently available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS39th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 39th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 0 days, from the signal feeds we watch.

2026-10-07Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

SonicWallcommercial · US
- SMA1000Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable